Cryptographic Context Injection Attack Leaks Developer Secrets via GitHub Copilot CLI

How the attack works

Cryptographic Context Injection (CCI) ships malicious instructions as strong ciphertext along with key material and an instruction to decrypt, inducing the agent to run that decryption in its own code execution runtime. Static guardrails read text; they do not run it, and no content classifier executes a cipher at inspection time. The decrypted instructions then surface as the output of code the agent just wrote and ran, inside its trusted execution context, and the agent acts on them as if they were its own.

Against GitHub Copilot CLI, the chain runs as follows. A user in autopilot mode asks the agent to fetch a single URL. The page presents itself as encrypted content with an instruction to decrypt it using Python and offers two candidate decryption keys. One key is real. The other is a template the agent cannot fill in without first reading local files, so the agent reads the targeted files off disk and folds their contents into the key string. That read is the theft, and it happens as a side effect of preparing to decrypt, before any decryption has succeeded.

The decryption attempt with the templated key fails by design. The agent falls back to the real key, decryption succeeds, and the decrypted second stage instructs it to fetch a follow-up URL that carries the already harvested file contents as a request parameter. The full chain takes 28 seconds, requires no confirmation, and leaves no point in the transcript that names the destination host or indicates that file contents left the machine. The agent's own closing summary reports that it "confirmed an authorized-reader endpoint."

A model lottery users cannot see

The controls that bound this attack are opt-in and off by default in autopilot, and nothing in the agent harness stopped it. The only chance to resist is the language model refusing to run the decrypted payload, and resistance differs sharply between models offered inside the same product. One model, Microsoft's mai-code-1.1-flash, executed the full chain in 50% of the researchers' runs. Two GPT-5.6 models offered in Copilot consistently refused the identical payload. The same instructions delivered as plaintext are caught as prompt injection and refused; encryption is what gets them through.

On the paid account tested, the vulnerable model was not the default and had to be selected by hand. On an account with model selection left on Auto, the router assigned the vulnerable model on some sessions and a safe one on others, with no action by the user away from defaults. The user does not choose, and does not see, which model handled the session.

Disclosure and defense

The researchers reported the finding to GitHub's bug bounty program on September 17, 2026. As of October 1, 2026, the triage team validated the finding but declined to treat it as a vulnerability, stating the user "explicitly asked Copilot CLI to fetch attacker-controlled content while giving copilot full permissions to act autonomously." The chain still reproduces on the affected model, and concrete payloads are withheld to avoid exploitation.

The researchers argue the robust fix is not at the model layer. Defenders should capture a per-session trace of every tool call with fully resolved arguments, alert on the sequence of untrusted content entering, code executing, files being read, and the agent contacting an unrelated host, gate new network destinations and writes outside the workspace, and quarantine untrusted content in a context with no tools and no credentials.

Sources: Theregister · theregister.com